Implement sample webhook endpoint for handling devportal events

[Piumal1999]

Purpose

Sample imlementation for devportal webhook

How to

Step 1 — Generate the RSA keypair
Run once on your machine:

openssl genrsa -out ./api-platform/gateway/gateway-controller/certificates/devportal-webhook.pem 2048
openssl rsa -in ./api-platform/gateway/gateway-controller/certificates/devportal-webhook.pem \
    -pubout -out /tmp/gateway-public.pem
cat /tmp/gateway-public.pem   # copy this — you'll paste it into the devportal config

Step 2 — Pick a shared secret

openssl rand -hex 32
# e.g. 7f4a2c9e1b8d3f6a0e5c7b2d9f4a1e8c...

Step 3 — Configure the gateway
Append to gateway/configs/config.toml:

[devportal_webhook]
enabled = true
secret = "7f4a2c9e1b8d3f6a0e5c7b2d9f4a1e8c..."   # your secret from step 2
private_key_path = "/app/certificates/devportal-webhook.pem"
gateway_type = "wso2/api-platform"   # must match what you put in devportal config.yaml

[devportal_webhook.idempotency]
ttl = "10m"
max_size = 10000

Step 4 — Configure the devportal
In the devportal's config.yaml (on your devportal server / mounted into the container), add:

webhooks:
  subscribers:
    - id: platform-gateway
      gatewayType: "wso2/api-platform"      # must match gateway_type above
      url: "http://gateway-controller:9090/webhooks/devportal"
      secret: "7f4a2c9e1b8d3f6a0e5c7b2d9f4a1e8c..."   # same secret
      publicKey: |
        -----BEGIN PUBLIC KEY-----
        <paste contents of /tmp/gateway-public.pem here>
        -----END PUBLIC KEY-----
      events:
        - apikey.*
        - subscription.*
      timeoutMs: 5000

Goals

Describe what solutions this feature or fix introduces to address the problems outlined above.

Approach

Describe how you are implementing the solutions. Include an animated GIF or screenshot if the change affects the UI. Include a link to a Markdown file or Google doc if the feature write-up is too long to paste here.

User stories

Summary of user stories addressed by this change>

Documentation

Link(s) to product documentation that addresses the changes of this PR. If no doc impact, enter “N/A” plus brief explanation of why there’s no doc impact

Automation tests

• Unit tests

  Code coverage information

• Integration tests

  Details about the test cases and coverage

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes/no
• Ran FindSecurityBugs plugin and verified report? yes/no
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes/no

Samples

Provide high-level details about the samples related to this feature

Related PRs

List any other related PRs

Test environment

List all JDK versions, operating systems, databases, and browser/versions on which this feature/fix was tested

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 05dd56a3-6b9e-4c94-99e6-32728c2c6165

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}